Privacy Policy

Who We Are

Cantaris Software is a trade name of Le Cercle VOF, registered with the Dutch Chamber of Commerce (KvK) under number 88834565, with its registered office at Salviastraat 22, 6351CE Bocholtz, The Netherlands. VAT number: NL002286991B69.

For the purposes of this Privacy Policy, "Cantaris Software", "we", "us" and "our" refer to Le Cercle VOF acting as data controller for the personal data described in this Policy.

We Do Not Access Your Client Data

Because we have no access to this end-user data, Cantaris Software does not act as a data processor for your client or patient data under the GDPR. The Customer is solely responsible for the lawful processing of their clients' personal data and for compliance with applicable privacy legislation in connection with their use of the Software.

We draw Customers' attention to the fact that voice recordings may, depending on how they are processed, qualify as special categories of personal data (biometric or health data) under Article 9 GDPR. If Customers process such data through the Software, they bear responsibility for identifying an appropriate legal basis under Article 9(2) GDPR and, where applicable, conducting a Data Protection Impact Assessment (DPIA) under Article 35 GDPR.

What Personal Data We Collect

To provide our subscription services to business customers, we collect the following categories of personal data:

• Account and identity data: first name, last name, company name, job title, and business email address.
• Financial and transaction data: billing address, VAT number (where applicable), subscription plan details, and payment history. Actual payment card details are processed exclusively by our payment provider Stripe and are not stored on our servers.
• Technical and usage data: IP address, login data, browser type and version, operating system, and information about how you interact with our website and customer portal.
• Communication data: the content of messages, questions, and information you provide when contacting our support team.

We collect this data directly from you when you register an account, purchase a subscription, or contact us.

How We Use Your Data and Our Legal Basis

We only process your personal data where we have a lawful basis under Article 6 GDPR.

• To create and manage your account and deliver the Software: we process account and identity data and technical data on the basis of performance of a contract (Article 6(1)(b) GDPR).
• To process payments and manage billing and invoicing: we process financial and transaction data on the basis of performance of a contract and compliance with a legal obligation (Article 6(1)(b) and (c) GDPR), including our obligations under Dutch tax law.
• To provide technical support and answer your questions: we process communication data and account data on the basis of our legitimate interest (Article 6(1)(f) GDPR). Our legitimate interest is to resolve technical issues efficiently and maintain the quality of our service. This processing is proportionate and does not unduly impact your interests or rights. You may object to this processing at any time (see Section 7).
• To send important updates about the Software, changes to our terms, or security notifications: we process account and identity data on the basis of performance of a contract and legitimate interest (Article 6(1)(b) and (f) GDPR). Our legitimate interest is to keep you informed of matters that directly affect your use of the Software and your contractual relationship with us. You may object to processing based on legitimate interest at any time.
• To comply with legal obligations: we process financial and transaction data on the basis of compliance with a legal obligation (Article 6(1)(c) GDPR).

We do not use your personal data for automated decision-making or profiling as referred to in Article 22 GDPR.

Sharing Your Data

We do not sell your personal data to third parties. We share your data with the following trusted service providers:

• Stripe Payments Europe Limited (payment processing): Stripe processes payment and billing data on our behalf. Stripe is an Irish-registered entity (Dublin) operating under agreements that include Standard Contractual Clauses approved by the European Commission for any transfers of data outside the EEA. Stripe participates in the EU-US Data Privacy Framework. Stripe's privacy policy is available at stripe.com/privacy.
• Hostnet B.V. (website hosting and email delivery): our website, customer portal, and email delivery services are hosted by Hostnet B.V., a Dutch provider with servers located in the Netherlands (within the EEA). No personal data is transferred outside the EEA via Hostnet.

All service providers are bound by data processing agreements as required under Article 28 GDPR and may only process your data for the specific purposes for which they are engaged.

International transfers: personal data transferred to Stripe may be processed in countries outside the EEA. In such cases, appropriate safeguards are in place in the form of Standard Contractual Clauses adopted by the European Commission and/or participation in the EU-US Data Privacy Framework. You may request a copy of the applicable safeguards by contacting us.

Data Retention

We retain your personal data only for as long as necessary for the purposes set out in this Policy.

• Account and identity data: retained for the duration of your active subscription and for 18 months after termination or expiry, to enable handling of outstanding queries, disputes, or final invoicing. After this period, data is deleted or anonymised.
• Financial and transaction data: retained for 7 years after termination of your subscription, as required by Dutch tax law (Article 52 of the Algemene wet inzake rijksbelastingen).
• Technical and usage data: retained for a maximum of 12 months from the date of collection, unless required for longer in connection with a security incident or legal proceeding.
• Communication and support data: retained for 2 years from the date of your last contact with our support team.

Your Rights Under the GDPR

As a data subject, you have the following rights:

• Right of access (Article 15 GDPR): you have the right to obtain confirmation of whether we process personal data about you and, if so, to receive a copy together with information about how it is processed.
• Right to rectification (Article 16 GDPR): you have the right to request correction of inaccurate or incomplete personal data.
• Right to erasure (Article 17 GDPR): you have the right to request deletion of your personal data where it is no longer necessary for the purposes for which it was collected, subject to our legal retention obligations.
• Right to restriction of processing (Article 18 GDPR): you have the right to request restriction of processing in certain circumstances, for example while the accuracy of your data is contested.
• Right to data portability (Article 20 GDPR): you have the right to receive personal data you have provided to us in a structured, commonly used, and machine-readable format, where processing is based on a contract or consent and is carried out by automated means.
• Right to object (Article 21 GDPR): you have the right to object at any time to processing based on our legitimate interest. We will cease processing unless we can demonstrate compelling legitimate grounds that override your interests, rights, and freedoms, or where processing is necessary for the establishment, exercise, or defence of legal claims.

To exercise any of these rights, please contact us at support@cantaris-software.com or by post at Salviastraat 22, 6351CE Bocholtz, The Netherlands. We will respond within one month of receipt of your request. We may extend this period by two months where the request is complex or we receive a high volume of requests, in which case we will inform you accordingly.

Cookies and Tracking Technologies

Our website uses cookies and similar tracking technologies. We use strictly necessary cookies to enable core website functionality including user authentication and session management. We use analytical cookies to understand how visitors use our website.

Non-essential cookies are placed only with your explicit consent, which you can provide or withdraw via the cookie consent banner displayed on your first visit to our website. You can also manage or delete cookies through your browser settings. Disabling certain cookies may affect website functionality.

For detailed information about the cookies we use, their purpose, and their retention period, please refer to our Cookie Policy available at cantaris-software.com/cookies.

Security

We implement appropriate technical and organisational measures to protect your personal data against unauthorised access, loss, destruction, or alteration. These measures include:

• Encryption of data in transit (TLS/HTTPS)
• Access controls limiting data access to authorised personnel only
• Regular security reviews of our infrastructure
• AES encryption of all locally stored Software data on Customer devices

In the event of a personal data breach likely to result in a high risk to your rights and freedoms, we will notify you without undue delay in accordance with Article 34 GDPR.

Changes to This Privacy Policy

We may update this Privacy Policy from time to time. If we make material changes, we will notify you by email to the address associated with your account or by a prominent notice on our website, at least 30 days before the change takes effect. The date at the top of this Policy indicates when it was last revised. Continued use of our services after the effective date constitutes acceptance of the updated Policy.

Contact Us

For questions about this Privacy Policy, to exercise your rights, or to request a copy of applicable international transfer safeguards, please contact us: